7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-45285

CVE-2023-45285: Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure ...

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-45285

CVE-2023-45285:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description clearly states that go get (which uses the cmd/go package) would fall back to the insecure git:// protocol for modules with a .git suffix even if GOINSECURE was not set. The primary evidence comes from the commit message for 9db318105e87f400d79753917933dd2193000913 ("cmd/go: do not fall back to insecure git:// for .git suffix") and the associated code changes in src/cmd/go/internal/modfetch/codehost/git.go. The function (*gitRepo).fetch is responsible for trying different network schemes to download repository data. The vulnerability was in how this function constructed its list of schemes to try, incorrectly including git:// as a fallback for .git suffixed paths when secure methods failed, without proper adherence to GOINSECURE settings. The patch corrected this scheme selection logic. The new test case TestGitInsecureSchemeFallback in git_test.go specifically verifies that this insecure fallback no longer occurs by attempting to fetch a .git suffixed module (via r.Stat, which calls fetch) that is only available over git:// and confirming failure when GOINSECURE does not permit it. This makes cmd/go/internal/modfetch/codehost.(*gitRepo).fetch the primary vulnerable function. The Stat method is included as it's a direct caller that would exhibit the vulnerable behavior due to its reliance on fetch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.